- no imported functions
- easy to use
- compile time seed / string hashes (different hashes everybuild with no need to change anything)
- saves the module handle by hash, for the next possible api, so that it wont search for the module in peb, but by hash in our map
- handles forwarded functions
PVOID pVirtualAlloc = FastGetProcAddress(HASH(kernel32.dll), HASH(VirtualAlloc));
// kernel32.dll handle is now saved, so the next call wont go through the peb one more time ...
PVOID pVirtualProtect = FastGetProcAddress(HASH(kernel32.dll), HASH(VirtualProtect));